Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4363-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4363-1 advisory. It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this ...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4364-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4364-1 advisory. It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker...

Fedora 31 : perl-Mojolicious (2020-aceb5a1d0a)

This package fixes a security issue that allowed for method query parameters to be used with GET requests. The fix is backported from Mojolicious v8.42. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

Ubuntu 20.04 LTS : Dovecot vulnerabilities (USN-4361-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4361-1 advisory. Philippe Antoine discovered that Dovecot incorrectly handled certain data. An attacker could possibly use this issue to cause a denial of service...

Fedora 30 : chromium (2020-06c54925d3)

The description provided by Fedora was far too silly to endure. Please consult the NIST CVEs for details on these Google Chromium vulnerabilities. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted...

Fedora 31 : 1:java-1.8.0-openjdk-aarch32 (2020-831ec85119)

8u252 update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc. The...

Debian DLA-2210-1 : apt security update

When normalizing ar member names by removing trailing whitespace and slashes, an out-out-bound read can be caused if the ar member name consists only of such characters, because the code did not stop at 0, but would wrap around and continue reading from the stack, without any limit. For Debian 8...

Ubuntu 18.04 LTS : IPRoute vulnerability (USN-4357-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4357-1 advisory. It was discovered that IPRoute incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. Tenable has extracted the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libexif vulnerabilities (USN-4358-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4358-1 advisory. It was discovered that libexif incorrectly handled certain tags. An attacker could possibly use this issue to cause a denial of...

Microsoft Patch Tuesday May 2020: comments from VM vendors, promising stuff for phishing, troubles with SharePoint and lulz with Visual Studio

This will be my third Microsoft Patch Tuesday report in video and audio format. And for the third time in a row, Microsoft has addressed over a hundred vulnerabilities. With my Microsoft Patch Tuesday parser, it was possible to generate a report almost on the same day. But, of course, it takes mu...

Fedora 30 : seamonkey (2020-36b36afea6)

Update to 2.53.2 If you have Lightning and/or Chatzilla extensions previously disabled, they are enabled after the update. Disable it again if needed in about:addons, or remove completely which can improve startup time. Note that Tenable Network Security has extracted the preceding description...

Photon OS 2.0: Linux PHSA-2020-2.0-0242

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0242. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136570...

Photon OS 1.0: Linux PHSA-2020-1.0-0292

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0292. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136555...

Fedora 30 : 1:java-1.8.0-openjdk (2020-21ca991b3b)

Update to OpenJDK 8u252 April Critical Patch Update - JDK-8223898, CVE-2020-2754: Forward references to Nashorn - JDK-8223904, CVE-2020-2755: Improve Nashorn matching - JDK-8224541, CVE-2020-2756: Better mapping of serial ENUMs - JDK-8224549, CVE-2020-2757: Less Blocking Array Queues - JDK-822560...

RHEL 7 : kernel-alt (RHSA-2020:2104)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2104 advisory. The kernel-alt packages provide the Linux kernel version 4.x. Security Fixes: kernel: double free may be caused by the function...

Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation Exploit

Druva inSync client for Windows exposes a network service on TCP port 6064 on the local network interface. inSync versions 6.5.2 and prior do not validate user-supplied program paths in RPC type 5 messages, allowing execution of arbitrary commands as SYSTEM. This Metasploit module has been tested...

Ubuntu 16.04 LTS / 18.04 LTS : Mailman vulnerability (USN-4354-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4354-1 advisory. It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary content in the login...

SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2020:1199-1)

This update for php7 fixes the following issues : CVE-2020-7064: Fixed a one byte read of uninitialized memory in exifreaddata bsc1168326. CVE-2020-7066: Fixed URL truncation getheaders if the URL contains zero \0 character bsc1168352. Note that Tenable Network Security has extracted the precedin...

Debian DLA-2206-1 : thunderbird security update

Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address, denial of service or potentially the execution of arbitrary code. For Debian 8 'Jessie', these problems have been fixed in version 1:68.8.0-1deb8u1. We recommend that you...

Fedora 30 : xen (2020-cbc3149753)

update to 4.11.4 ---- multiple xenoprof issues XSA-313, CVE-2020-11740, CVE-2020-11741 1823912, 1823914 Missing memory barriers in read-write unlock paths XSA-314, CVE-2020-11739 1823784 Bad error path in GNTTABOPmapgrant XSA-316, CVE-2020-11743 1823926 Bad continuation handling in GNTTABOPcopy...